PT-2025-33079 · Unknown · Quickshare File Server

Published 2025-08-13 · Updated 2025-08-14 · CVE-2011-10010

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: QuickShare File Server version 1.2.1

Description: QuickShare File Server version 1.2.1 contains a path traversal vulnerability in its FTP service due to improper sanitation of user-supplied file paths. Authenticated users can exploit this flaw by submitting crafted sequences to access or write files outside the intended virtual directory. When the “Writable” option is enabled (default during account creation), attackers can upload arbitrary files to privileged locations such as system32, enabling remote code execution via MOF injection or executable placement.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2011-10010

Affected Products

Quickshare File Server

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2011-10010 · Security Note
• https://web.archive.org/web/20120125101026/http://quicksharehq.com/blog/quickshare-file-server-1-2-2-released.html · Note
• https://t.me/cveNotify/132270 · Telegram Post
• https://web.archive.org/web/20110814125645/http://digital-echidna.org/2011/02/quickshare-file-share-1-2-1-directory-traversal-vulnerability · Note
• https://exploit-db.com/exploits/18933 · Note
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/quickshare_traversal_write.rb · Note
• https://vulncheck.com/advisories/quickshare-file-server-path-traversal-rce · Note
• https://exploit-db.com/exploits/16105 · Note
• https://t.me/CVEtracker/29926 · Telegram Post